Notifications

Winnipeg Transit gave Peggo card travel history to police without warrants

CBC News has learned that Winnipeg Transit handed over the private travel history of bus riders to law enforcement without requiring a warrant on four occasions since March 2017 — a practice Manitoba's ombudsman says complies with privacy laws.

City officials confirm police requested data 4 times since March

The Peggo card system allows bus officials to track the exact daily travel habits of thousands of passengers. (Trevor Brine/CBC)

Winnipeg Transit has handed over the private travel history of bus riders to law enforcement without requiring a warrant, CBC News has learned.

City officials confirmed that on four occasions since March of 2017, Winnipeg police have requested the data generated through the use of Peggo cards for a specific passenger to assist with an investigation.

On each occasion, the transit service provided police with the desired records.

Winnipeg Police said the travel data was requested to help with one missing person investigation and three criminal investigations and was therefore releasable under provincial privacy laws.

Police spokesperson Tammy Skrabek confirmed that one arrest occurred as a result of the Peggo card data. She said that law enforcement have many tools at their disposal and accessing data directly from government agencies is generally used as a last resort.

Peggo cards leave digital footprints

In July of 2016, Winnipeg Transit launched its new Peggo card system, which allows users to pay their fare using an electronic card.

It also allows Transit officials to track the exact travel habits of the 130,000 daily Transit passengers.

Every time a passenger uses their Peggo card, data is generated on the date, time, bus number, boarding and transfer locations. If the user has registered their card online, the passenger's name becomes linked to the data.

A spokesperson previously said the transit planning department uses this information to better assess ridership needs and to enhance services, but analysts are not given access to the names of the registered users to protect the privacy of it's ridership.

'Quite appropriate to question it', expert.

Tom Keenan, a professor at the University of Calgary who specializes in information security says citizens are generally unaware of the trail of information they leave behind.

"I see a growing sensitivity to this kind of information and it is quite appropriate to question it," says Keenan.

"What we don't want to have is any kind of fishing expeditions [...] the fear is that police will go out there and see everybody who got off at a certain corner and start making inferences from that," he said.

Did you know that every time you hop on the bus and scan you Peggo bus pass to pay your fare, you are providing the city with a detailed travel itinerary of your movements through out the city? CBC News has learned that since March, transit officials have shared the private records of four individuals with the Winnipeg Police without a warrant and without their consent. 2:32

Info release above board: Ombudsman

The privacy and information watchdog for the province says that under the Freedom of Information and Protection of Privacy Act, or FIPPA, any public body can release personal information to law enforcement without the need for a warrant or the consent of the individual being targeted under certain conditions.

Specifically, Section 44(1) of the act outlines conditions under which a public body may disclose personal information to law enforcement:

If necessary to protect the health and safety of individuals.

To comply with warrants or other court orders.

For use in legal proceedings involving police.

For law enforcement purposes or crime prevention.

"Every authorized use or disclosure of personal information is required to be limited to the minimum amount of information necessary to accomplish the purpose of the disclosure," said Nancy Love, senior legislative and policy analyst for the ombudsman's office.

City officials said they comply with legal requirements and hand over only what is required.

"Every use and disclosure of personal information by or on behalf of the city is limited to the minimum amount of information necessary to accomplish the purpose for which it is used or disclosed," said spokesperson Kailey Barron.

However, the ombudsman's office says this decision making process is ultimately left up to each agency.

"FIPPA does not require a public body to have specific policies about making disclosures. Policies are a best practice," said Love.

She said that in theory, law enforcement can access records about individual citizens from any public body that falls under FIPPA legislation without a warrant. This does not include medical records, which is protected under the Personal Health Information Act or commonly referred to as PHIA.

Winnipeg Mayor Brian Bowman said while he has been assured transit complied with privacy legislation, he wants to know more about what councillors were told about Peggo privacy before the cards went online last year.

"I have inquired with the former chair of [public works], Coun. Janice Lukes, just to see what discussions and due diligence may have occurred by the committee in advance of Peggo being launched, but my understanding is the manner in which Winnipeg Transit has worked with law enforcement has been compliant with privacy legislation," Bowman said.

A sample of your Peggo card footprint

The following table is an actual sample of data gathered by a Peggo card user. The card number and a few other records have been modified for privacy reasons.